EUVD-2026-72542Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the prerequisite that Lua script submission must be reachable by the attacker; C:H for potential exfiltration of sensitive columns like password hashes; no integrity or availability impact.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
4DescriptionCVE.org
Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list.
AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's operation aggregate path in AshLua.Runtime took the field name straight from the Lua call and resolved it with only String.to_existing_atom and Ash.Query.Aggregate.new!, neither of which consults the exposed-field allow-list the normal fields path enforces. A script can therefore read the value of any attribute of any record the actor may read, including private sensitive?: true columns, via resource.read({ operation = {"list", "hashed_password"} }); min and max give a value oracle. Anyone able to submit or influence a Lua script can reach this.
This issue affects ash_lua: from 0.1.0 before 0.2.1.
AnalysisAI
Sensitive field disclosure in ash_lua (versions 0.1.0 through 0.2.0) allows any actor who can submit a Lua script to read Ash resource attributes that are deliberately excluded from the manifest's exposed-field allow-list - including sensitive?: true columns such as hashed passwords. The operation aggregate path in AshLua.Runtime resolved field names directly via String.to_existing_atom and Ash.Query.Aggregate.new! …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker can submit or directly influence a Lua script evaluated by AshLua.Runtime in the target application - this is the primary gating condition. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H) accurately captures a high confidentiality impact tempered by a non-trivial attack requirement (AT:P): the attacker must already have the ability to submit or influence a Lua script evaluated by the application. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ash_lua to version 0.2.1 or later; the patch is confirmed via commit c0dfcd9494766d548178c37df0bd01cff378e1c7 and version boundaries established in the EUVD and GHSA advisory at https://github.com/ash-project/ash_lua/security/advisories/GHSA-37jv-wc37-fhcw. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications using ash_lua versions 0.1.0 through 0.2.0 and identify which accept Lua script inputs from potentially untrusted sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-424 – Improper Protection of Alternate Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today